HighFix available
python3.11, python3.13 and 1 more products — security advisory
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
- Products
- python3.11, python3.13, python3.14
- Affected versions
- 3.11.2-6, 3.11.2-6+deb12u1, 3.11.2-6+deb12u2, 3.11.2-6+deb12u3, 3.11.2-6+deb12u4, 3.11.2-6+deb12u5, 3.11.2-6+deb12u6, 3.11.2-6+deb12u7, 3.11.2-6+deb12u8, 3.13.11-1, 3.13.12-1, 3.13.5-2, 3.13.5-2+deb13u1, 3.13.5-2+deb13u2, 3.13.6-1, 3.13.7-1, 3.13.8-1, 3.13.9-1, 3.14.0-1, 3.14.0-2, 3.14.0-3, 3.14.0-4, 3.14.0-5, 3.14.0~a7-1, 3.14.0~b1-1, 3.14.0~b2-1, 3.14.0~b3-1, 3.14.0~b4-1, 3.14.0~rc1-1, 3.14.0~rc2-1, 3.14.0~rc3-1, 3.14.2-1, 3.14.3-1, 3.14.3-2, 3.14.3-3, 3.14.3-4, 3.14.3-5, 3.14.4-1, 3.14.4-2, 3.14.5-1, 3.14.5~rc1-1
- Fixed versions
- 3.11.2-6+deb12u9, 3.13.14-1, 3.13.5-2+deb13u3, 3.14.6-1
- CVEs
- CVE-2026-9669
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:02 UTC · Revision 1
Source evidence
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
osv:DEBIAN-CVE-2026-9669
python3.11
Fixed versions: 3.11.2-6+deb12u9
python3.13
Fixed versions: 3.13.5-2+deb13u3
python3.13
Fixed versions: 3.13.14-1
python3.14
Fixed versions: 3.14.6-1
Complete source record
{
"id": "5ac46d88d0db3adae6aef8cc0a4838d84d034f6cd5584bffbc0cde545286c7b2",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-9669",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-9669",
"summary": "bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.",
"evidence": "osv:DEBIAN-CVE-2026-9669",
"products": [
{
"name": {
"value": "python3.11",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.11.2-6+deb12u9",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3.11.2-6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u2",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u3",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u4",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u5",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u6",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u7",
"evidence": "/affected/0/versions"
},
{
"value": "3.11.2-6+deb12u8",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.5-2+deb13u3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "3.13.5-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.13.5-2+deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "3.13.5-2+deb13u2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python3.13",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.13.14-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.13.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.12-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.8-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.13.9-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python3.14",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.14.6-1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "3.14.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~a7-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~b4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc1-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.0~rc3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-3",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-4",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.3-5",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.5-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.14.5~rc1-1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2026-9669",
"aliases": [
"DEBIAN-CVE-2026-9669"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.2-6+deb12u9"
}
]
}
],
"package": {
"name": "python3.11",
"purl": "pkg:deb/debian/python3.11?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.11.2-6",
"3.11.2-6+deb12u1",
"3.11.2-6+deb12u2",
"3.11.2-6+deb12u3",
"3.11.2-6+deb12u4",
"3.11.2-6+deb12u5",
"3.11.2-6+deb12u6",
"3.11.2-6+deb12u7",
"3.11.2-6+deb12u8"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-9669.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.5-2+deb13u3"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.13.5-2",
"3.13.5-2+deb13u1",
"3.13.5-2+deb13u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-9669.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.13.14-1"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.5-2",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-9669.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.6-1"
}
]
}
],
"package": {
"name": "python3.14",
"purl": "pkg:deb/debian/python3.14?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.14.0-1",
"3.14.0-2",
"3.14.0-3",
"3.14.0-4",
"3.14.0-5",
"3.14.0~a7-1",
"3.14.0~b1-1",
"3.14.0~b2-1",
"3.14.0~b3-1",
"3.14.0~b4-1",
"3.14.0~rc1-1",
"3.14.0~rc2-1",
"3.14.0~rc3-1",
"3.14.2-1",
"3.14.3-1",
"3.14.3-2",
"3.14.3-3",
"3.14.3-4",
"3.14.3-5",
"3.14.4-1",
"3.14.4-2",
"3.14.5-1",
"3.14.5~rc1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-9669.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-08T09:00:09.259798883Z",
"provider": "osv",
"upstream": [
"CVE-2026-9669"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-9669"
]
},
"related_cves": [
{
"value": "CVE-2026-9669",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 98828,
"published_at": "2026-06-08T23:17:25.17+00:00"
}